Baseline Cyber Security Controls for Small and Medium Organizations

This guidance document offers a set of recommended cybersecurity practices tailored for small and medium organizations in Canada, defined as having fewer than 500 employees. It addresses common cybersecurity threats, such as cybercrime, and presents an actionable list of controls aimed at mitigating these risks, including incident response planning, automatic patching, secure configurations, and employee awareness training. The document emphasizes cost-effective measures and acknowledges the practical limitations faced by smaller entities. It also provides insights into organizational controls, baseline controls, and threat levels specific to this sector. This publication is part of Canada's broader effort to improve national cybersecurity resilience.